mirror of
https://github.com/pen4uin/java-memshell-generator.git
synced 2026-09-22 01:30:43 +08:00
This commit is contained in:
@@ -410,6 +410,26 @@ public class AbstractConfig {
|
||||
|
||||
private String jarClassName;
|
||||
|
||||
public byte[] getBytesInLoader() {
|
||||
return bytesInLoader;
|
||||
}
|
||||
|
||||
public void setBytesInLoader(byte[] bytesInLoader) {
|
||||
this.bytesInLoader = bytesInLoader;
|
||||
}
|
||||
|
||||
private byte[] bytesInLoader;
|
||||
|
||||
public String getClassNameInLoader() {
|
||||
return classNameInLoader;
|
||||
}
|
||||
|
||||
public void setClassNameInLoader(String classNameInLoader) {
|
||||
this.classNameInLoader = classNameInLoader;
|
||||
}
|
||||
|
||||
private String classNameInLoader;
|
||||
|
||||
public void build() {
|
||||
// 检查 serverType、modelType、formatType 是否已设置
|
||||
if (this.toolType == null || this.serverType == null || this.shellType == null || this.outputFormat == null || this.gadgetType == null) {
|
||||
@@ -429,8 +449,6 @@ public class AbstractConfig {
|
||||
this.setShellClassName(ClassNameUtil.getRandomShellClassName(this.getShellType()));
|
||||
if (this.getShellSimpleClassName() == null)
|
||||
this.setShellSimpleClassName(CommonUtil.getSimpleName(this.getShellClassName()));
|
||||
if (this.getOutputFormat().contains(Constants.FORMAT_BCEL))
|
||||
this.setLoaderClassName(ClassNameUtil.getRandomLoaderClassName());
|
||||
this.setSavePath(CommonUtil.getFileOutputPath(this.getOutputFormat(), this.getInjectorSimpleClassName(), this.getSavePath()));
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
package jmg.core.format;
|
||||
|
||||
import jmg.core.config.AbstractConfig;
|
||||
import jmg.core.util.ClassNameUtil;
|
||||
import me.gv7.woodpecker.bcel.HackBCELs;
|
||||
|
||||
import java.io.IOException;
|
||||
@@ -9,7 +10,15 @@ public class BCELFormater implements IFormater {
|
||||
|
||||
|
||||
public byte[] transform(byte[] clazzbyte, AbstractConfig config) throws IOException {
|
||||
// 解决 BCEL 的classloader 的问题
|
||||
// 解决 BCEL ClassLoader 带来的问题
|
||||
if (config.isEnabledExtender()){
|
||||
config.setBytesInLoader(config.getExtenderBytes());
|
||||
config.setClassNameInLoader(config.getExtenderClassName());
|
||||
}else{
|
||||
config.setBytesInLoader(config.getInjectorBytes());
|
||||
config.setClassNameInLoader(config.getInjectorClassName());
|
||||
}
|
||||
config.setLoaderClassName(ClassNameUtil.getRandomLoaderClassName());
|
||||
byte[] bcelClzBytes = BCELoaderGenerator.generatorBCELoaderClass(config);
|
||||
return HackBCELs.encode(bcelClzBytes).getBytes();
|
||||
}
|
||||
|
||||
@@ -17,9 +17,9 @@ public class BCELoaderGenerator {
|
||||
ctClass.setName(config.getLoaderClassName());
|
||||
ctClass.getClassFile().setVersionToJava5();
|
||||
CtMethod getClassName = ctClass.getDeclaredMethod("getClassName");
|
||||
getClassName.setBody(String.format("{return \"%s\";}", config.getInjectorClassName()));
|
||||
getClassName.setBody(String.format("{return \"%s\";}", config.getClassNameInLoader()));
|
||||
CtMethod getBase64String = ctClass.getDeclaredMethod("getBase64String");
|
||||
String base64ClassString = encodeToBase64(config.getInjectorBytes()).replace(System.lineSeparator(), "");
|
||||
String base64ClassString = encodeToBase64(config.getBytesInLoader()).replaceAll("[\\s*\t\n\r]", "");
|
||||
String[] parts = splitChunks(base64ClassString, 40000);
|
||||
StringBuilder result = new StringBuilder();
|
||||
for (int i = 0; i < parts.length; i++) {
|
||||
|
||||
@@ -382,8 +382,6 @@ public class jMGForm {
|
||||
config.setUrlPattern("/*");
|
||||
}
|
||||
}
|
||||
if (config.getOutputFormat().contains(Constants.FORMAT_BCEL))
|
||||
config.setLoaderClassName(ClassNameUtil.getRandomLoaderClassName());
|
||||
config.setInjectorSimpleClassName(CommonUtil.getSimpleName(config.getInjectorClassName()));
|
||||
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user